# Vulnerabilities published in 2024


- [CVE-2024-10617](https://insights.sbomify.com/CVE-2024-10617/): Tongda OA check_seal.php sql injection (medium 5.3)
- [CVE-2024-10616](https://insights.sbomify.com/CVE-2024-10616/): Tongda OA webSignSubmit.php sql injection (medium 5.3)
- [CVE-2024-10615](https://insights.sbomify.com/CVE-2024-10615/): Tongda OA 2017 delete_data_attach.php sql injection (medium 5.3)
- [CVE-2024-10614](https://insights.sbomify.com/CVE-2024-10614/): Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation (medium 4.3)
- [CVE-2024-10613](https://insights.sbomify.com/CVE-2024-10613/): ESAFENET CDG SystemEncryptPolicyService.java delSystemEncryptPolicy sql injection (medium 5.3)
- [CVE-2024-10612](https://insights.sbomify.com/CVE-2024-10612/): ESAFENET CDG HookInvalidCourseService.java removeHookInvalidCourse sql injection (medium 5.3)
- [CVE-2024-10611](https://insights.sbomify.com/CVE-2024-10611/): ESAFENET CDG PrintScreenListService.java delProtocol sql injection (medium 5.3)
- [CVE-2024-10610](https://insights.sbomify.com/CVE-2024-10610/): ESAFENET CDG ProtocolService.java delProtocol sql injection (medium 5.3)
- [CVE-2024-1061](https://insights.sbomify.com/CVE-2024-1061/): SQL injection in bplugins:html5 video player (high 8.6)
- [CVE-2024-10609](https://insights.sbomify.com/CVE-2024-10609/): itsourcecode Tailoring Management System Project typeadd.php sql injection (medium 5.3)
- [CVE-2024-10608](https://insights.sbomify.com/CVE-2024-10608/): code-projects Courier Management System login.php sql injection (medium 6.9)
- [CVE-2024-10607](https://insights.sbomify.com/CVE-2024-10607/): code-projects Courier Management System track-result.php sql injection (medium 6.9)
- [CVE-2024-10606](https://insights.sbomify.com/CVE-2024-10606/): WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update (medium 4.3)
- [CVE-2024-10605](https://insights.sbomify.com/CVE-2024-10605/): code-projects Blood Bank Management System request.php cross-site request forgery (medium 6.9)
- [CVE-2024-10604](https://insights.sbomify.com/CVE-2024-10604/): Identifiable Header Values In Fuchsia Leading To Tracking of The User (medium 6.9)
- [CVE-2024-10603](https://insights.sbomify.com/CVE-2024-10603/): Weak cryptography in gVisor (medium 6.3)
- [CVE-2024-10602](https://insights.sbomify.com/CVE-2024-10602/): Tongda OA 2017 data_picker_link.php sql injection (medium 5.3)
- [CVE-2024-10601](https://insights.sbomify.com/CVE-2024-10601/): Tongda OA 2017 delete.php sql injection (medium 5.3)
- [CVE-2024-10600](https://insights.sbomify.com/CVE-2024-10600/): Tongda OA 2017 submenu.php sql injection (medium 6.9)
- [CVE-2024-1060](https://insights.sbomify.com/CVE-2024-1060/): Use after free in Chrome (high 8.8)
- [CVE-2024-10599](https://insights.sbomify.com/CVE-2024-10599/): Tongda OA 2017 package_static_resources.php resource consumption (medium 6.9)
- [CVE-2024-10598](https://insights.sbomify.com/CVE-2024-10598/): Tongda OA Annual Leave data.php improper authorization (medium 6.9)
- [CVE-2024-10597](https://insights.sbomify.com/CVE-2024-10597/): ESAFENET CDG PolicyActionService.java delPolicyAction sql injection (medium 5.3)
- [CVE-2024-10596](https://insights.sbomify.com/CVE-2024-10596/): ESAFENET CDG EncryptPolicyTypeService.java delEntryptPolicySort sql injection (medium 5.3)
- [CVE-2024-10595](https://insights.sbomify.com/CVE-2024-10595/): ESAFENET CDG PublicDocInfoAjax.java delDifferCourseList sql injection (medium 5.3)
- [CVE-2024-10594](https://insights.sbomify.com/CVE-2024-10594/): ESAFENET CDG FileDirectoryService.java docHistory sql injection (medium 5.3)
- [CVE-2024-10593](https://insights.sbomify.com/CVE-2024-10593/): WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion (medium 4.3)
- [CVE-2024-10592](https://insights.sbomify.com/CVE-2024-10592/): Mapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10591](https://insights.sbomify.com/CVE-2024-10591/): Missing authorization in MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics (high 8.8)
- [CVE-2024-10590](https://insights.sbomify.com/CVE-2024-10590/): Opt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-1059](https://insights.sbomify.com/CVE-2024-1059/): Use after free in Chrome (high 8.8)
- [CVE-2024-10589](https://insights.sbomify.com/CVE-2024-10589/): Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (critical 9.8)
- [CVE-2024-10588](https://insights.sbomify.com/CVE-2024-10588/): Debug Tool <= 2.2 - Missing Authorization to Information Exposure (medium 4.3)
- [CVE-2024-10587](https://insights.sbomify.com/CVE-2024-10587/): Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-10586](https://insights.sbomify.com/CVE-2024-10586/): Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation (critical 9.8)
- [CVE-2024-10585](https://insights.sbomify.com/CVE-2024-10585/): InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading (medium 5.3)
- [CVE-2024-10584](https://insights.sbomify.com/CVE-2024-10584/): DirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-10583](https://insights.sbomify.com/CVE-2024-10583/): Cross-site scripting in Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder (medium 5.4)
- [CVE-2024-10582](https://insights.sbomify.com/CVE-2024-10582/): Missing authorization in Music Player for Elementor – Audio Player & Podcast Player (medium 4.3)
- [CVE-2024-10581](https://insights.sbomify.com/CVE-2024-10581/): DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update (medium 4.3)
- [CVE-2024-10580](https://insights.sbomify.com/CVE-2024-10580/): Missing authorization in Hustle – Email Marketing, Lead Generation, Optins, Popups (medium 5.3)
- [CVE-2024-1058](https://insights.sbomify.com/CVE-2024-1058/): SiteOrigin Widgets Bundle <= 1.58.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10579](https://insights.sbomify.com/CVE-2024-10579/): Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure (medium 4.3)
- [CVE-2024-10578](https://insights.sbomify.com/CVE-2024-10578/): Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation (high 8.8)
- [CVE-2024-10577](https://insights.sbomify.com/CVE-2024-10577/): Fat Rat Collect <= 2.7.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10576](https://insights.sbomify.com/CVE-2024-10576/): Unauthorized factory reset of Infinix devices (critical 9.4)
- [CVE-2024-10575](https://insights.sbomify.com/CVE-2024-10575/): Missing authorization in EcoStruxure IT Gateway (critical 10.0)
- [CVE-2024-10574](https://insights.sbomify.com/CVE-2024-10574/): Missing authorization in Quiz Maker Agency (high 7.2)
- [CVE-2024-10573](https://insights.sbomify.com/CVE-2024-10573/): Mpg123: buffer overflow when writing decoded pcm samples (medium 6.7)
- [CVE-2024-10572](https://insights.sbomify.com/CVE-2024-10572/): Denial of Service and Arbitrary File Write in h2oai/h2o-3 (high 7.5)
- [CVE-2024-10571](https://insights.sbomify.com/CVE-2024-10571/): Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source (critical 9.8)
- [CVE-2024-10570](https://insights.sbomify.com/CVE-2024-10570/): SQL injection in Login Security, FireWall, Malware removal by CleanTalk (high 7.5)
- [CVE-2024-1057](https://insights.sbomify.com/CVE-2024-1057/): Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (medium 6.4)
- [CVE-2024-10569](https://insights.sbomify.com/CVE-2024-10569/): Zip Bomb Vulnerability in gradio-app/gradio (high 7.5)
- [CVE-2024-10568](https://insights.sbomify.com/CVE-2024-10568/): Ajax Search Lite < 4.12.4 - Admin+ Stored XSS (medium 4.7)
- [CVE-2024-10567](https://insights.sbomify.com/CVE-2024-10567/): TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access (high 7.5)
- [CVE-2024-10566](https://insights.sbomify.com/CVE-2024-10566/): Slider by 10Web < 1.2.62 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-10565](https://insights.sbomify.com/CVE-2024-10565/): Slider by 10Web < 1.2.62 - Admin+ Stored XSS via Widget (medium 6.1)
- [CVE-2024-10563](https://insights.sbomify.com/CVE-2024-10563/): WooCommerce Cart Count Shortcode < 1.1.0 - Contributor+ XSS (medium 5.4)
- [CVE-2024-10562](https://insights.sbomify.com/CVE-2024-10562/): Form Maker by 10Web < 1.15.31 - Admin+ Stored XSS (low 2.7)
- [CVE-2024-10561](https://insights.sbomify.com/CVE-2024-10561/): Codezips Pet Shop Management System birdsupdate.php sql injection (medium 6.9)
- [CVE-2024-10560](https://insights.sbomify.com/CVE-2024-10560/): Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-1056](https://insights.sbomify.com/CVE-2024-1056/): Cross-site scripting in FunnelKit Funnel Builder Pro (medium 6.4)
- [CVE-2024-10559](https://insights.sbomify.com/CVE-2024-10559/): SourceCodester Airport Booking Management System details buffer overflow (medium 4.8)
- [CVE-2024-10558](https://insights.sbomify.com/CVE-2024-10558/): Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-10557](https://insights.sbomify.com/CVE-2024-10557/): code-projects Blood Bank Management System updateprofile.php cross-site request forgery (medium 6.9)
- [CVE-2024-10556](https://insights.sbomify.com/CVE-2024-10556/): Codezips Pet Shop Management System birdsadd.php sql injection (medium 6.9)
- [CVE-2024-10555](https://insights.sbomify.com/CVE-2024-10555/): MaxButtons < 9.8.1 - Admin+ Stored XSS via Button Width (medium 4.8)
- [CVE-2024-10554](https://insights.sbomify.com/CVE-2024-10554/): WP-Advanced-Search < 3.3.9.3 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-10553](https://insights.sbomify.com/CVE-2024-10553/): Jdbc Deserialization in h2oai/h2o-3 (critical 9.8)
- [CVE-2024-10552](https://insights.sbomify.com/CVE-2024-10552/): Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters (medium 6.4)
- [CVE-2024-10551](https://insights.sbomify.com/CVE-2024-10551/): Sticky Social Icons <= 1.2.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10550](https://insights.sbomify.com/CVE-2024-10550/): Denial of Service by ReDOS in h2oai/h2o-3 (high 7.5)
- [CVE-2024-1055](https://insights.sbomify.com/CVE-2024-1055/): Cross-site scripting in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (medium 5.4)
- [CVE-2024-10549](https://insights.sbomify.com/CVE-2024-10549/): Denial of Service by ReDOS in h2oai/h2o-3 (high 7.5)
- [CVE-2024-10548](https://insights.sbomify.com/CVE-2024-10548/): Information disclosure in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker (medium 6.5)
- [CVE-2024-10547](https://insights.sbomify.com/CVE-2024-10547/): WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-10546](https://insights.sbomify.com/CVE-2024-10546/): open-scratch Teaching 在线教学平台 URL getDictItemsByTable sql injection (medium 5.3)
- [CVE-2024-10545](https://insights.sbomify.com/CVE-2024-10545/): NextGEN Gallery < 3.59.9 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-10544](https://insights.sbomify.com/CVE-2024-10544/): Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files (medium 5.3)
- [CVE-2024-10543](https://insights.sbomify.com/CVE-2024-10543/): Tumult Hype Animations <= 1.9.14 - Missing Authorization (medium 4.3)
- [CVE-2024-10542](https://insights.sbomify.com/CVE-2024-10542/): Missing authorization in Spam protection, Honeypot, Anti-Spam by CleanTalk (critical 9.8)
- [CVE-2024-10540](https://insights.sbomify.com/CVE-2024-10540/): SQL injection in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress (medium 5.3)
- [CVE-2024-1054](https://insights.sbomify.com/CVE-2024-1054/): Booster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10539](https://insights.sbomify.com/CVE-2024-10539/): Reflected XSS in Uyumsoft's ERP (medium 5.5)
- [CVE-2024-10538](https://insights.sbomify.com/CVE-2024-10538/): Happy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison (medium 6.4)
- [CVE-2024-10537](https://insights.sbomify.com/CVE-2024-10537/): Missing authorization in WP User Manager – User Profile Builder & Membership (medium 4.3)
- [CVE-2024-10536](https://insights.sbomify.com/CVE-2024-10536/): Missing authorization in FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor (medium 4.3)
- [CVE-2024-10535](https://insights.sbomify.com/CVE-2024-10535/): Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion (medium 5.3)
- [CVE-2024-10534](https://insights.sbomify.com/CVE-2024-10534/): Improper Access Control in Dataprom Informatics' PACS-ACSS (high 8.6)
- [CVE-2024-10533](https://insights.sbomify.com/CVE-2024-10533/): WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation (medium 4.3)
- [CVE-2024-10532](https://insights.sbomify.com/CVE-2024-10532/): Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import (medium 4.3)
- [CVE-2024-10531](https://insights.sbomify.com/CVE-2024-10531/): Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update (medium 5.3)
- [CVE-2024-10530](https://insights.sbomify.com/CVE-2024-10530/): Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition (medium 4.3)
- [CVE-2024-1053](https://insights.sbomify.com/CVE-2024-1053/): Event Tickets and Registration <= 5.8.1 - Missing Authorization (medium 4.3)
- [CVE-2024-10529](https://insights.sbomify.com/CVE-2024-10529/): Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion (medium 5.3)
- [CVE-2024-10528](https://insights.sbomify.com/CVE-2024-10528/): Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update (medium 4.3)
- [CVE-2024-10527](https://insights.sbomify.com/CVE-2024-10527/): Spacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure (low 3.1)
- [CVE-2024-10526](https://insights.sbomify.com/CVE-2024-10526/): Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service (high 8.6)
- [CVE-2024-10525](https://insights.sbomify.com/CVE-2024-10525/): Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/506/